CVE-2007-4906

NuclearBB Alpha 2 - Remote Code Execution via root_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4906. PoCs published by Rootshell Security.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in NuclearBB Alpha 2. The vulnerable parameter `root_path` in `send_queued_emails.php` allows an attacker to include arbitrary remote files, leading to potential remote code execution (RCE) if `register_globals` is enabled.

Description

PHP remote file inclusion vulnerability in tasks/send_queued_emails.php in NuclearBB Alpha 2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Rootshell Security · textwebappsphp

https://www.exploit-db.com/exploits/4395

View Code ZIP pw:eip

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in NuclearBB Alpha 2. The vulnerable parameter `root_path` in `send_queued_emails.php` allows an attacker to include arbitrary remote files, leading to potential remote code execution (RCE) if `register_globals` is enabled.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: NuclearBB Alpha 2

No auth needed

Prerequisites: register_globals enabled · remote file inclusion allowed by PHP configuration

MITRE ATT&CK